Stowage/ladybird
2
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-12-08 06:09:58 +00:00
Code Issues Projects Releases Packages Wiki Activity

AK+LibWeb: Make StringBase::bytes() lvalue-only

Browse source 
Disallow calling `StringBase::bytes()` on temporaries to avoid returning
`ReadonlyBytes` that outlive the underlying string.

With this change, we catch a real UAF:
`load_result.data = maybe_response.release_value().bytes();`
All other updated call sites were already safe, they just needed to use
an intermediate named variable to satisfy the new lvalue-only
requirement.
This commit is contained in:
Aliaksandr Kalenik 2025-11-25 18:06:48 +01:00 • committed by Tim Flynn
parent d1f34efa64
commit 69cede4a0f
Notes: github-actions[bot] 2025-11-25 18:03:33 +00:00
8 changed files with 31 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

6
Libraries/LibWeb/HTML/HTMLFormElement.cpp
View file

@ -861,7 +861,8 @@ ErrorOr<void> HTMLFormElement::submit_as_entity_body(URL::URL parsed_action, Vec
auto pairs = TRY(convert_to_list_of_name_value_pairs(entry_list));
// 2. Let body be the result of running the application/x-www-form-urlencoded serializer with pairs and encoding.
body = TRY(ByteBuffer::copy(url_encode(pairs, encoding).bytes()));
auto query = url_encode(pairs, encoding);
body = TRY(ByteBuffer::copy(query.bytes()));
// 3. Set body to the result of encoding body.
// NOTE: `encoding` refers to `UTF-8 encode`, which body already is encoded as because it uses AK::String.
@ -888,7 +889,8 @@ ErrorOr<void> HTMLFormElement::submit_as_entity_body(URL::URL parsed_action, Vec
auto pairs = TRY(convert_to_list_of_name_value_pairs(entry_list));
// 2. Let body be the result of running the text/plain encoding algorithm with pairs.
body = TRY(ByteBuffer::copy(TRY(plain_text_encode(pairs)).bytes()));
auto serialized_body = TRY(plain_text_encode(pairs));
body = TRY(ByteBuffer::copy(serialized_body.bytes()));
// FIXME: 3. Set body to the result of encoding body using encoding.